diff --git a/Dockerfile b/Dockerfile
index 557bfe423..a21c52014 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,9 +1,9 @@
 # syntax=docker/dockerfile-upstream:master
 
 ARG RUNC_VERSION=v1.5.2
-ARG CONTAINERD_VERSION=v2.3.6
+ARG CONTAINERD_VERSION=v2.4.1
 # CONTAINERD_ALT_VERSION_... defines fallback containerd version for integration tests
-ARG CONTAINERD_ALT_VERSION_22=v2.2.9
+ARG CONTAINERD_ALT_VERSION_23=v2.3.6
 ARG CONTAINERD_ALT_VERSION_17=v1.7.36
 ARG REGISTRY_VERSION=v2.8.3
 ARG ROOTLESSKIT_VERSION=v3.2.0
@@ -276,11 +276,11 @@ ARG CONTAINERD_VERSION
 ADD --keep-git-dir=true "https://github.com/containerd/containerd.git#$CONTAINERD_VERSION" .
 RUN /build.sh
 
-# containerd-alt-22 builds containerd v2.2 for integration tests
-FROM containerd-build AS containerd-alt-22
+# containerd-alt-23 builds containerd v2.3 for integration tests
+FROM containerd-build AS containerd-alt-23
 WORKDIR /go/src/github.com/containerd/containerd
-ARG CONTAINERD_ALT_VERSION_22
-ADD --keep-git-dir=true "https://github.com/containerd/containerd.git#$CONTAINERD_ALT_VERSION_22" .
+ARG CONTAINERD_ALT_VERSION_23
+ADD --keep-git-dir=true "https://github.com/containerd/containerd.git#$CONTAINERD_ALT_VERSION_23" .
 RUN /build.sh
 
 # containerd-alt-17 builds containerd v1.7 for integration tests
@@ -449,7 +449,7 @@ RUN curl -fsSL https://raw.githubusercontent.com/moby/moby/v25.0.1/hack/dind > /
   && chmod 0755 /docker-entrypoint.sh
 ENTRYPOINT ["/docker-entrypoint.sh"]
 # musl is needed to directly use the registry binary that is built on alpine
-ENV BUILDKIT_INTEGRATION_CONTAINERD_EXTRA="containerd-2.2=/opt/containerd-alt-22/bin,containerd-1.7=/opt/containerd-alt-17/bin"
+ENV BUILDKIT_INTEGRATION_CONTAINERD_EXTRA="containerd-2.3=/opt/containerd-alt-23/bin,containerd-1.7=/opt/containerd-alt-17/bin"
 ENV BUILDKIT_INTEGRATION_SNAPSHOTTER=stargz
 ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1
 ENV BUILDKIT_TEST_SIGN_FIXTURES=/tmp/buildkit_test_sign_fixtures
@@ -465,7 +465,7 @@ COPY --link --from=silo /usr/bin/mcli /usr/bin/mc
 COPY --link --from=nydus /out/nydus-static/* /usr/bin/
 COPY --link --from=stargz-snapshotter /out/* /usr/bin/
 COPY --link --from=rootlesskit /rootlesskit /usr/bin/
-COPY --link --from=containerd-alt-22 /out/containerd* /opt/containerd-alt-22/bin/
+COPY --link --from=containerd-alt-23 /out/containerd* /opt/containerd-alt-23/bin/
 COPY --link --from=containerd-alt-17 /out/containerd* /opt/containerd-alt-17/bin/
 COPY --link --from=registry /out /usr/bin/
 COPY --link --from=runc /usr/bin/runc /usr/bin/